squashfs-tools-ng
LOW
maintainer Goliath
4 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The source is a tarball from the maintainer's own project domain, used to build the software from source; this is normal AUR packaging behavior despite the non-whitelisted host.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the maintainer's own project domain, used to build the software from source; this is normal AUR packaging behavior despite the non-whitelisted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:12
source=(https://infraroot.at/pub/squashfs/${pkgname}-${pkgver}.tar.xz{,.asc}
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: David Oberhollenzer <goliath at infraroot dot at>
2
3
pkgname=('squashfs-tools-ng' 'squashfs-tools-ng-doc')
4
pkgver=1.3.2
5
pkgrel=1
6
epoch=
7
pkgdesc='A new set of tools and libraries for working with SquashFS images'
8
url='https://infraroot.at/projects/squashfs-tools-ng/index.html'
9
arch=('x86_64')
10
license=('GPL3' 'LGPL3')
11
depends=('lzo' 'lz4' 'xz' 'zstd' 'zlib' 'attr' 'bzip2')
12
source=(https://infraroot.at/pub/squashfs/${pkgname}-${pkgver}.tar.xz{,.asc}
13
)
14
sha512sums=('6f14d90875ef3f3d36d3cd38932ade6b0da7284922c914bd655e3f0a4abb17ba75d4bc052a1d4244c1b4ff96b3798d83d5a7b3263b8e1b96c112f4cdf967400f'
15
'SKIP'
16
)
17
validpgpkeys=('13063F723C9E584AEACD5B9BBCE5DC3C741A02D1')
18
groups=()
19
makedepends=(
20
'fakeroot'
21
'binutils'
22
'autoconf'
23
'automake'
24
'autogen'
25
'libtool'
26
'pkgconf'
27
'm4'
28
'make'
29
'gcc'
30
'doxygen')
31
#
32
checkdepends=()
33
optdepends=()
34
provides=()
35
conflicts=()
36
replaces=()
37
backup=()
38
options=()
39
install=
40
changelog=
41
noextract=()
42
43
prepare() {
44
cd "$pkgname-$pkgver"
45
}
46
47
build() {
48
cd "$pkgname-$pkgver"
49
./configure --prefix=/usr
50
make
51
make doxygen-doc
52
}
53
54
check() {
55
cd "$pkgname-$pkgver"
56
make -k check
57
}
58
59
package_squashfs-tools-ng() {
60
#depends=('zstd' 'attr' 'zlib' 'xz' 'lzo' 'bzip2' )
61
cd "$pkgname-$pkgver"
62
make DESTDIR="$pkgdir/" install
63
}
64
65
package_squashfs-tools-ng-doc() {
66
arch=('any')
67
optdepend=()
68
depends=()
69
cd "$pkgbase-$pkgver"
70
install -d "$pkgdir/usr/share/doc/$pkgbase"
71
cp -a doxygen-doc/* "$pkgdir/usr/share/doc/$pkgbase"
72
}
73
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |